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Brussels, 6 April 2022 
Ref: OUT2022-0026 
Sent by e-mail only 


Dear President of the Belgian Chamber of Representatives Tillieux, 
Dear Prime Minister De Croo, 
Dear State Secretary Michel, 


CC: Vice-President Jourová, 
Commissioner Reynders, 


In its Plenary meetings of 22 February 2022 and 14 March 2022, the European Data Protection Board 
(EDPB) was made aware of legislative developments in Belgium that may affect one of our members, 
the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit (GBA) / L'Autorité de 
protection des données (APD)). With this letter, the EDPB would like to express its concern about these 
developments, particularly where they may negatively impact the stability and the independent 
functioning of the GBA/APD and thereby the consistent application of the GDPR. For that reason, 
despite the fact that it is not its role to assess how a specific national legislation ensures compliance 
with Article 52 GDPR, the EDPB considers it important to bring this matter to your attention. 


In particular, these legislative developments concern a draft law aimed at reforming the Belgian law of 
3 December 2017 establishing the GBA/APD (AH-2022-0020). This draft law was approved by the 
Belgian Council of Ministers on 28 January 2022. In the draft law, several changes are introduced to 
the structure, the governance and the staff of the GBA/APD. Most notably, the draft law aims to: 

- interrupt the current mandate of all of the GBA/APD’s external members‘, who will change 
status and no longer take part in deliberations within the Litigation Chamber and the 
Knowledge Centre; 

- add new grounds for dismissal of members, if they obstruct the proper functioning of the 
GBA/APD or if they fail to respect the collegiality of the executive committee; 

- and strengthen parliamentary oversight over the functioning of the GBA/APD, for instance by 
requiring parliamentary approval of the GBA/APD’s strategic plan and its internal Rules of 
Procedure, or by providing for a procedure of evaluation of the members which can already 
start one year before the end of their mandate. 


1 The Belgian DPA Act uses both “external members” and “members” when referring to the members of the 
Litigation Chamber in charge of enforcement and adoption of corrective measures and the Knowledge Centre, in 
charge of the adoption of opinions on new Belgian legislative and administrative measures relating to data 
protection. Despite the fact that they are not employed on a full-time basis, these individuals are considered to 
be formal members of the GBA/APD as they have decisional power for the adoption of decisions or opinions. 
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In addition to this reform, the Belgian Government proposed another draft legislation,” providing that 
the GBA/APD is to make use of a mandatory shared service centre for the execution of tasks related 
to HR, IT, security of information, finance and procurement. As the externalisation of these resources, 
which are directly linked to the autonomous functioning of the GBA/APD, will thus be imposed on the 
GBA/APD without prior consultation, the draft legislation would further undermine the independence 
of the GBA/APD in light of Article 52 GDPR — e.g. with regard to the recruitment, administration and 
management of its internal personnel. 


First and foremost, the EDPB recalls that independent supervision is an essential element of the 
fundamental right to data protection under Article 8(3) of the EU Charter of Fundamental Rights and 
Article 16(2) of the EU Treaty. This requirement has been applied strictly by the Court of Justice, which 
has condemned the lack of independence of authorities judgments concerning infringement 
proceedings against Germany, Austria and Hungary,’ and its opinion concerning the failure of Canada 
to provide for independent supervision in the draft EU-Canada PNR Agreement.* Most notably, the 
Court has specifically ruled that “it is not permissible for a Member State to require that a supervisory 
authority vacates its office before serving its full term”, as the threat of such termination could lead to 
“a form of prior compliance with the political authority, which is incompatible with the requirement of 
independence.” This even holds true in case “premature termination of the term served comes about 
as a result of the restructuring or changing of the institutional model.” > 


The EDPB also recalls that the GDPR specifically requires that each supervisory authority shall act with 
complete independence in performing its tasks and exercising its powers (Article 52(1) GDPR). This 
entails, amongst other things, that members of each supervisory authority shall, in the performance 
of their tasks and exercise remain free from external influence (Article 52(2) GDPR), that Member 
States shall ensure that each supervisory authority chooses and has its own staff which shall be subject 
to the exclusive direction of the member or members of the supervisory authority concerned (Article 
52(5) GDPR) and that Member States shall ensure that each supervisory authority is provided with the 
human, technical and financial resources, premises and infrastructure necessary for the effective 
performance of its tasks and exercise of its powers (Article 52(4) GDPR). 


Seen in this context, the EDPB is concerned about the impact that the proposed reforms may have on 
the independent functioning of the Belgian Data Protection Authority. The EDPB considers that the 
proposals to interrupt the current mandate of the GBA/APD’s external members may be at odds with 
the abovementioned case law of the Court of Justice.° Furthermore, the EDPB considers that the added 
grounds of dismissal in the draft law may be inconsistent with Article 53(4) GDPR, which clearly states 
that “a member shall be dismissed only in cases of serious misconduct or if the member no longer 


? According to the Opinion of the GBA/APD on the new draft legislation. Opinion on preliminary draft law 
amending the Act of 3 December 2017 establishing the Data Protection Authority (AH-2022-0020), paras. 3 and 
24, see: https://www.autoriteprotectiondonnees.be/publications/opinion-on-preliminary-draft-law-amending- 
the-act-of-3-december-2017-establishing-the-data-protection-authority.pdf 

3 CJEU Case C-518/07 — judgement of 9 March 2010 (Commission v. Germany), CJEU Case C- 614/10 — Judgement 
of 16 October 2012 (Commission v. Austria), CJEU Case C-288/12 — Judgement of 8 April 2014 (Commission v. 
Hungary). 

* Opinion 1/15 of the Court of 26 July 2017, para 229, 230 and 232. 

> See CJEU Case C-518/07 — judgement of 9 March 2010 (Commission v. Germany), para. 36, CJEU Case C- 614/10 
— Judgement of 16 October 2012 (Commission v. Austria), para. 51 and CJEU Case C-288/12 — Judgement of 8 
April 2014 (Commission v. Hungary), paras. 54, 55 and 60. 

© This is without prejudice to the assessment made by the European Commission in the infringement procedure 
against Belgium concerning the appointment of two external members of the GBA/APD, for which the situation 
is now resolved. 





fulfils the conditions required for the performance of the duties.” The EDPB also questions how the 
various proposals for increased parliamentary oversight relate to the requirement to “remain free 
from external influence” (Article 52(2) GDPR). Lastly, the EDPB recognizes that the proposal to make 
obligatory use of a shared service centre may conflict with Article 52(5) GDPR, as quoted above. 


As you are well aware, independent supervision is the cornerstone of effective enforcement. This holds 
especially true in a system like the GDPR, which is dependent on effective cooperation between equal 
counterparts. Due to the impact that the draft law may have on the functioning of the GBA/APD and 
the fact that the draft law is already at an advanced stage at national level, the EDPB considers it 
important to draw your attention to these developments. 


Last, but not least, the EDPB emphasizes that the abovementioned developments may be increasingly 
pressing considering the upcoming expansion of supervisory powers and tasks of both the national 
data protection authorities and the Board itself, in view of the adoption of a number of acts in the 
digital area that are designed to build on the GDPR.’ 


The EDPB remains committed to ensure a full and consistent implementation of the GDPR throughout 
the EEA and, to that end, facilitates the effective cooperation between its Members and their bilateral 
and multilateral exchanges of information and best practices, which relies on the authorities’ abilities 


to act independently and in full capacity. 


Yours sincerely, 


Aleid Wolfsen 


” Regulation on Privacy and Electronic Communications, Artificial Intelligence Act, Data Governance Act. 
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